201210021520 10ty4c

explained decrypted filler

3DES(name+title) ECB, 13 GUIDs, seed 539

Metadata

Post ID: 10ty4c
Title: 201210021520 → 2012-10-02 15:20 on A858's clock
Posted (UTC): 2012-10-02 19:20:27
Timezone: UTC−4 · title 15:20 against posted 19:20 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 848 hex characters · 424 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210021520) = 3cec27514972a29ed6be8a85f65b8b9f (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 13
Filler GUID seed: new Random(539).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 34 · predicted N = 13 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

16F66959335A77C6 68E6C80C05F3520C C32E4D47AE2491EA E14F0B40DBC2765D 06A98CFC6152BC96 E2EE1D1A817741E7 248F2AC2EA2CC0F5 C934691A6A612F15 2DD34939D0BDF05D EE1757A3727A036D B0B205A883C5E647 5FFF82D8EEEF752C FB9B621B918282D0 A1C125D55A1373B5 4DB629FAF450EAC6 82CC217437BE2CAF 4CF68C5DC80B8977 06681EBAC3F79154 26E47B7D7BE74F5A 89953B96E654D34D FD64503C1D75C015 FB81D349B3294CB3 4C8A91138251499E 3C30135218B76DD2 BF9E0CADA7B6411E 1920E161A1887D4E 2D15E3E227671687 B492D8F5B11A2D98 18933EA5260FF276 89C01A433546C741 1C389B947E2DC8A8 1361965F524CCD7B 008AA2B1129B6962 6C9F1F648D47EE7C A1CE6E81A4DF1CD1 730F50A3F02A95A0 83D4828628F04A29 8AF3AFD6BA6393BB EED4B87DC292F0A4 1A03E216CCF4F3E2 001F103B18E0BFE7 6381CC870BF71020 F2AF85E6AD4E5D1C 7DBE0BB0BFF395A3 A8B58B452C32AC71 BA622F2F970F7D89 8E230AE86E4B87FE 471D11649E26B7ED EFDD4110DD12BEA5 FE016E7357036D16 0F5F1C0A5711C3D2 01CAAFEC072CF6E7 1E8573424EA760A3

Read the ciphertext. Strip whitespace: 848 hex characters = 424 bytes = 53 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210021520 (name+title). Key = MD5(password) = 3cec27514972a29ed6be8a85f65b8b9f, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 13 GUIDs as hex (shown below).

Decrypted: GUID list

  1 34e67765-1de9-24ad-b297-e762a0e9f6b5
  2 380a092c-4820-86b8-aefa-2b31cf6d9382
  3 a0659a3c-578b-4675-9b6c-36ddea7cd267
  4 2800da4d-3434-5e4d-850d-ae47efb5dcd4
  5 6ac23133-8785-57f6-b304-556e4af342df
  6 1ea081f9-5186-54ae-b275-31bcf46e233a
  7 cd81062f-e330-37c4-830c-8ca35aacc555
  8 fa4f1da7-9893-7982-a3cc-36b51b19a6a7
  9 96d16962-492d-5206-b3b8-0111032511b5
 10 3e8725f1-e660-0fef-8043-053500befc06
 11 adb20def-88dd-3fa5-abac-2461dd7bc350
 12 0b2ba815-0221-238a-97d6-193967bf3f01
 13 973f0fbd-68d9-1bcb-a04c-5498934bc18f

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 2845553750321. Exactly this sequence comes out of new Random(539).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 34 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 13; the post has N = 13 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related